CVE-2025-62675

LOW

Fortinet FortiOS - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Title source: rule
STIX 2.1

Description

An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicking on a crafted link.

References (1)

Core 1

Scores

CVSS v3 3.4
EPSS 0.0024
EPSS Percentile 15.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-113
Status published
Products (19)
Fortinet/FortiOS 6.4.0 - 6.4.16
Fortinet/FortiOS 7.0.0 - 7.0.19
Fortinet/FortiOS 7.2.0 - 7.2.13
fortinet/fortios 7.2.0 - 7.6.5
Fortinet/FortiOS 7.4.0 - 7.4.12
Fortinet/FortiOS 7.6.0 - 7.6.4
Fortinet/FortiPAM 1.0.0 - 1.0.3
Fortinet/FortiPAM 1.1.0 - 1.1.2
Fortinet/FortiPAM 1.2.0
Fortinet/FortiPAM 1.3.0 - 1.3.1
... and 9 more
Published Jul 14, 2026
Tracked Since Jul 14, 2026